> ## Documentation Index
> Fetch the complete documentation index at: https://rapidreview.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CLI configuration

> Where nisa keeps credentials and settings, the environment variables it reads, and how it picks a credential.

<Warning>
  The CLI reads `RAPIDREVIEW_KEY`, `NISA_API_URL`, and `~/.nisa/`. The Python SDK reads `RAPIDREVIEW_API_KEY`, `RAPIDREVIEW_API_URL`, and `~/.rapidreview/`. Different variables, different directories.
</Warning>

## Files

| Path                                 | Purpose                                                                                                                                                     |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `~/.nisa/credentials.json`           | OAuth tokens and/or an API key — the one you pasted, or the one the chat's browser onboarding mints (`nisa-cli-<hostname>`); `nisa login` stores OAuth only |
| `~/.nisa/config.json`                | Optional; only `api_url` is read                                                                                                                            |
| `~/.nisa/ratelimit.json` (+ `.lock`) | Per-machine chat rate-limit state                                                                                                                           |
| `~/.nisa/credentials.refresh.lock`   | Serializes token refresh — refresh tokens are one-shot, so parallel `nisa` processes must not race. This is why agents use a key                            |
| `~/.local/bin/nisa`                  | Install location; `NISA_INSTALL_DIR=/usr/local/bin` prompts for sudo                                                                                        |

An old `~/.papyrus/` is moved to `~/.nisa/` once, on first run.

## Environment variables

| Variable                             | Effect                                                                                                                                                         |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `RAPIDREVIEW_KEY`                    | API key (`rr_sk_…`); highest-priority credential                                                                                                               |
| `NISA_API_URL`                       | Backend base URL (default `https://api.rapidreview.io`)                                                                                                        |
| `NISA_INSTALL_DIR`                   | Installer target                                                                                                                                               |
| `NISA_VERSION`                       | Pin a release for the installer, e.g. `NISA_VERSION=v0.2.14`; `curl -fsSL https://storage.googleapis.com/rr_cli_releases/latest/VERSION` shows the current one |
| `PAPYRUS_API_KEY`, `PAPYRUS_API_URL` | Pre-0.3.0 names, still read as fallbacks                                                                                                                       |

## Precedence

Credential: `RAPIDREVIEW_KEY` → `api_key` in `credentials.json` → OAuth token in `credentials.json` (auto-refreshed). Every request sends `Authorization: Bearer <credential>`. `nisa doctor --json` reports the winner as `auth.source` (`RAPIDREVIEW_KEY` · `stored_api_key` · `oauth_credentials` · `none`). One consequence: while a key wins, `nisa keys …` answers `403 API key management requires browser login`.

API URL: `--api-url` (before the subcommand) → `NISA_API_URL` → `config.json` → default.

## `nisa doctor --json`

`ok`, `version`, `platform{os,arch,target}`, `install{current_exe,install_dir_on_path}`, `backend{api_url}`, `config{config_dir,config_dir_writable,credentials_file,credentials_file_exists}`, `auth{usable,source,rapidreview_key_set,stored_api_key_present,oauth_credentials_present,legacy_papyrus_api_key_set}`, `fixes[]`. Never prints secrets.

## Install and upgrade

macOS arm64/x86\_64, Linux x86\_64/arm64 (static musl); no Windows. The installer verifies a SHA-256 checksum, self-tests `nisa --version`, and prints a `PATH` hint if needed. Fallback URL if `api.rapidreview.io/cli/*` is unreachable: `https://storage.googleapis.com/rr_cli_releases/install.sh`. `nisa upgrade` re-runs the installer in place (`--check` exits `1` if newer exists). `nisa logout` deletes the local file only — revoke keys with `nisa keys revoke <id>`.